Confidentiality obligations require ESG rating providers to restrict use and disclosure of information and adopt protective policies.

Regulation 28T requires ESG rating providers to treat information supplied by any person as confidential, disclose it only when required by law or with the provider's written consent, and not use such information for purposes other than undertaking ESG ratings without written consent; it further mandates adoption and implementation of written policies and procedures to protect non-public information related to ESG rating products.

---

---

---